Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: fix-followup-hardening.md(PR#92) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: two strands land together — (1) the remaining 20 module-level govulncheck advisories against x/crypto v0.37.0 clear to the upstream floor via Backend#25 (19 fixed, GO-2026-5932 unfixed upstream); (2) backend main (daddac8) and core main (cafd9a5) from the parallel cardflow merge were not yet pinned, and backend main no longer built against the Dev-pinned core — pinning the coherent pair keeps main verifiable.
Evidence: combined make test exit 0 at backend daddac8 + core cafd9a5 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend go test green and govulncheck 0 affected / 0 import-level / 1 module-level; task.sh hardening smoke-verified (drift measurement, identity probe, abandon cleanup all PASS).
Impact: two gitlink pins + task card; no Dev-repo source change; remote branch hygiene (55 merged branches deleted) and global git identity were environment fixes outside the repo.
Refs: .task/fix-followup-hardening.md, Backend PR #25
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-cardflow-r1.md(PR#90) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: two recurring papercuts from 2026-09-30 sessions — (1) task-start treated a zero-exit submodule update as complete, but a worktree could still carry 12 drifted/uninitialized nested submodules that only surfaced at build time; (2) close ran a single git push, so a tunnel hiccup left the card-close branch unpushed and the auto-PR never created (hand-patched twice that day).
Evidence: bash -n clean; smoke start of a throwaway task measured nested drift count explicitly and abandon-path finish recycled worktree and branch cleanly (both PASS); fresh-clone commit identity probe also PASS after setting the global identity outside this repo.
Impact: scripts/task.sh cmd_start (+3-line status check) and cmd_close (one retry on push); no interface change.
Refs: .task/fix-followup-hardening.md
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: fix-dep-vuln-bumps.md(PR#88) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: fix-close-pr-retry.md(PR#86) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: cmd_close posted the PR with a single curl wrapped in
2>/dev/null || true, so any transient TLS/timeout on the git-home
HTTPS surface left the card-close branch pushed with no PR and no
diagnostics; this hit three times on 2026-09-30 and each needed a
manual API call to recover.
Evidence: bash -n clean; stub-server harness running the block
verbatim (sed-extracted from this file, executed inside the worktree
branch context): ok mode recovers the PR URL on first POST; exists
mode (POST always 500) retries 4x with visible stderr then recovers
the pre-existing open PR via GET ?state=open matching head ref;
fail mode against the retired git-panel host shows four visible
retry notices and falls through to the existing [next] hint.
Impact: scripts/task.sh cmd_close only; precheck/start/sync/finish
untouched; card-close merge authority unchanged (owner merges).
post-merge hook and task-finish auto-close inherit the fix through
the same function.
Refs: task card fix-close-pr-retry
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: fix-blobstore-id-hardening.md(PR#84) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: branches merged into main had left their task cards open; backfill status and archive to prevent bookkeeping debt.
Evidence: feature-branch-hierarchy-clause.md(PR#82) — merges verified via git log --merges against origin/main.
Impact: .task/*.md moved to .task/archive/ with status backfilled; no code or submodule change.
Refs: task.sh close (card-autoclose-r1)
Why: worktree feature branches occasionally spawned child branches
(e.g. backend feature/cross-session-reading-1-gcb7f79d) outside the
task-start gate; collaboration.md conditionally allows stacked branches
but the Dev entry never said so, leaving stacking as an automation
blind spot with ad-hoc sha-embedded names.
Evidence: collaboration.md common-baseline section states the stacking
exception verbatim; historical numbered branches are all already merged
into main (origin/main..branch empty); precheck READY at R0=7d45719869.
Impact: AGENTS.md only. Default stays single-level branches from
origin/main with sibling branches for batch subtasks; stacking requires
recording the parent task/PR in the card, child naming without embedded
SHAs, parent-before-child merge order, and a sync back onto latest main
with PR base retargeted before merge (branch protection enforces this).
Refs: task card feature-branch-hierarchy-clause
Why: Dev gitlinks lagged behind merged module mains (backend fa494c3,
frontend b067b57, documents f0361f38, plus deps advances); the integrated
build should track each repo's main.
Evidence: make pin advanced all listed submodules; make test exit 0
(frontend 33/33, ui 37/37, backend go test all ok, agent-command ok).
Impact: gitlink bumps only, no source changes.
Refs: housekeeping after chat-process-split-r1 (PR #79)
Why: the 2026-09-30 deep security scan triage left one actionable finding: backend Local.Put joined the HTTP-supplied artifact id into the store directory unsanitized (reachable via UpdateArtifactContent path parameter), and Get/Delete took stored refs unvalidated. Backend PR #22 adds validID on Put plus a directory-containment check on Get/Delete with unit tests.
Evidence: backend go vet ./... and go test -count=1 ./... pass (3 new blobstore test groups green); Dev make test combined verification exit 0 across core+backend+frontend+ui+agentcmd (log tail shows test-ui 37/37, agentcmd ok); gitlink pinned to backend main f98dc1d after confirming it already contains the chat-process pointer 76d64a1 (no regression).
Impact: modules/backend gitlink only (+task card); no Dev-repo code change.
Refs: .task/fix-blobstore-id-hardening.md, backend PR #22
weichen
weichen